fedup and selinux

Chris Murphy lists at colorremedies.com
Tue Dec 24 16:23:46 UTC 2013

On Dec 24, 2013, at 2:42 AM, Bill Murray <bill.murray at cern.ch> wrote:

>  Dear all,
>    I had trouble persuading 'fedup --network 20' to run on my f19 laptop.  It install all the files and gets ready. Then it boots and gets as far as:
> [ OK ] Started trigger flushing of journal to persistent storage
> [ OK ] Started Forward Password Requests to Plymouth
> [ OK ] Started Forward Password Requests to Plymouth
> [ OK] Started Recreate Volatile files and Directories
> There are then 3 lines of selinux permission denied. But no problem, selinux is set permissive anyway.
> Earlier on I see 'dracut-initqueue[400] failed to issue method call: Access denied'
> However, when I add selinux=0 to the command line..installation proceeds.
> This is very odd - selinux was in permissive mode.
>  This is a bug I think?

On a test VM with dracut and systemd debugging enabled (so it's slow):

[    5.094179] type=1404 audit(1387844762.554:2): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295

The upgrade environment comes up in enforcing mode.

[   37.388496] upgrade[665]: /bin/upgra[   37.427863] type=1404 audit(1387844794.861:9): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295
de at 18(setstate): UPGRADE_STATE=running

Then goes to permissive mode. For fully 32 seconds it is in enforcing mode. And I see quite a few dracut-initqueue process entries at 15 seconds through 21 seconds. So all the preliminary setup logic before the upgrade runs, happens with enforcing enabled.

It's not so good to use selinux=0 because it totally disables selinux and all the labels on files will be unset. You should instead use enforcing=0 which allows selinux to correctly label the system, while not enforcing policy. So I suggest that now that your system is upgraded to Fedora 20, assuming you leave selinux running in enforcing mode on this system, that you relabel it with:
restorecon -R -v /

As for whose bug this is, it could be mislabeling from the F19 system. But now that the system is upgraded it's difficult to reproduce to file a bug. I first would have tried a relabel from within Fedora 19: restorecon -R -v /

and then tried the update without changing the selinux behavior. If it still failed, then I'd do: ausearch -m AVC

to see exactly what's being denied and file a bug against it, or maybe against selinux-policy if the request is reasonable and the denial isn't. And then I'd rerun the upgrade with enforcing=0 as a work around.

Chris Murphy

More information about the users mailing list